@theronap/agnoclast-mcp 0.9.210 → 0.9.211

package/lib/imessage_send.mjs

@@ -1,88 +1,78 @@
-// send_imessage — outbound iMessage via Messages.app. This is a personal automation, NOT org
-// intelligence: it writes nothing to Agnoclast. Three layers of safety (eng-review D3/D6/D10):
-//   D6  argv-safe: recipient + body are passed as osascript `on run argv` arguments, NEVER
-//       interpolated into the script source → no AppleScript injection, no quote/newline breakage.
-//   D3  draft-by-default: nothing sends unless the caller explicitly passes send:true.
-//   D10 recipient gating: an MCP send tool is reachable by any agent context (prompt-injection
-//       surface), so a boolean alone is not enough. Allowlisted recipients send on send:true;
-//       OFF-list recipients additionally require an out-of-band confirm secret the agent context
-//       doesn't have (CORTEX_IMESSAGE_SEND_CONFIRM), else the send is BLOCKED.
-import { spawn } from 'child_process'
+// send_imessage — ask to send a text from the user's own Mac, the same way request_send_email asks to
+// send an email (ADR-0076).
+//
+// WHAT CHANGED, AND WHY. This tool used to text directly: osascript → Messages.app on whatever machine
+// the MCP ran on, gated by CORTEX_IMESSAGE_SEND_ALLOWLIST and an out-of-band confirm secret. No
+// approval screen, no history, no "did it go out?", and nothing written to Agnoclast — while email had
+// all of it. Theron, 2026-10-05: "my texts are not being handled in the same way that emails are
+// handled, and that seems like a failure."
+//
+// Now it creates a request on agnoclast.com (POST /api/texts/send-requests). The request waits on
+// /email → Waiting for the user's OK, unless their send rule — the SAME rule email uses, set only on
+// the web — lets it through. Once approved, the user's Mac (the Agnoclast desktop app) sends it through
+// Messages and reports back. So:
+//   * this process never runs osascript and never sends anything itself;
+//   * the env allowlist and the confirm secret are gone — the web send rule replaced both, and an agent
+//     cannot loosen it;
+//   * without send:true it is still a draft preview, exactly as before, so existing callers that rely on
+//     draft-by-default see no change in that path.
+//
+// ⚠ THE POST IS NOT IDEMPOTENT. Never retried: a 5xx may mean the request was created.
 
-// AppleScript reads its inputs from argv — the message text is DATA, never code.
-const SEND_SCRIPT = `on run argv
-  set targetId to item 1 of argv
-  set targetMessage to item 2 of argv
-  tell application "Messages"
-    set targetService to 1st account whose service type = iMessage
-    set targetBuddy to participant targetId of targetService
-    send targetMessage to targetBuddy
-  end tell
-end run`
-
-export function phoneKey(raw) {
-  const d = String(raw).replace(/[^0-9]/g, '')
-  return d.length < 7 ? null : d.slice(-10)
-}
-function handleKey(h) {
-  return h.includes('@') ? h.trim().toLowerCase() : phoneKey(h)
-}
-export function loadSendAllowlist(raw = process.env.CORTEX_IMESSAGE_SEND_ALLOWLIST ?? '') {
-  const set = new Set()
-  for (const item of raw.split(',').map((s) => s.trim()).filter(Boolean)) {
-    set.add(item.includes('@') ? item.toLowerCase() : (phoneKey(item) ?? item))
-  }
-  return set
+/** PURE. The draft preview — unchanged in spirit from the old tool. */
+export function draftText({ recipient, message }) {
+  return `📝 DRAFT (not sent) — to ${recipient}:\n${message}\n\n(Call send_imessage again with send:true to ask the user to approve it.)`
 }
 
-// Pure decision: what should happen, given inputs + config. Testable without Messages.app.
-//   → { action: 'draft' | 'send' | 'blocked', reason }
-export function decideSend({ recipient, message, send, confirm, allowlist, confirmSecret }) {
-  if (!recipient || !String(recipient).trim()) return { action: 'blocked', reason: 'no recipient' }
-  if (!message || !String(message).trim()) return { action: 'blocked', reason: 'empty message' }
-  if (!send) return { action: 'draft', reason: 'draft-by-default — re-call with send:true to actually send' }
-  const key = handleKey(String(recipient))
-  if (key && allowlist.has(key)) return { action: 'send', reason: 'allowlisted recipient' }
-  // off-list: require the out-of-band confirm secret
-  if (confirmSecret && confirm && confirm === confirmSecret) return { action: 'send', reason: 'off-list send authorized by confirm secret' }
-  return {
-    action: 'blocked',
-    reason: confirmSecret
-      ? 'recipient not allowlisted — pass the out-of-band confirm secret to send, or add them to CORTEX_IMESSAGE_SEND_ALLOWLIST'
-      : 'recipient not allowlisted — add them to CORTEX_IMESSAGE_SEND_ALLOWLIST (or set CORTEX_IMESSAGE_SEND_CONFIRM for an out-of-band override)',
-  }
-}
-
-export function sendViaOsascript(recipient, message) {
-  return new Promise((resolve) => {
-    let err = ''
-    let proc
-    try {
-      proc = spawn('osascript', ['-', String(recipient), String(message)], { stdio: ['pipe', 'ignore', 'pipe'] })
-    } catch (e) {
-      resolve({ ok: false, error: String(e) }); return
+/**
+ * PURE. The server's answer → what the agent is told. Mirrors request_send_email's contract exactly:
+ * `reviewUrl` PRESENT means pending, and the hand-off sentence is relayed verbatim; ABSENT means the
+ * user's send rule already approved it, and there is nothing to approve.
+ *
+ * Returns { text, isError }.
+ */
+export function textRequestReply(status, body, recipient) {
+  const msg = typeof body?.error === 'string' ? body.error : null
+  if (status === 201 || (status >= 200 && status < 300)) {
+    const reviewUrl = body?.reviewUrl
+    if (reviewUrl) {
+      return { isError: false, text:
+        `Text request created to ${recipient}. It is NOT sent yet. ` +
+        `Tell the user, in these words: It's waiting for your OK: ${reviewUrl}` }
     }
-    proc.stderr.on('data', (d) => { err += d })
-    proc.on('error', (e) => resolve({ ok: false, error: String(e) }))
-    proc.on('close', (code) => resolve({ ok: code === 0, error: err.trim() }))
-    proc.stdin.write(SEND_SCRIPT)
-    proc.stdin.end()
-  })
+    const state = body?.request?.state ?? 'approved'
+    return { isError: false, text:
+      `Approved by the user's send rule — nothing to approve (state: ${state}). Their Mac sends it through ` +
+      `Messages the next time it checks in, usually within a minute. Do not offer an approval link, and do ` +
+      `not send it again; the user can see how it went on Email → History in Agnoclast.` }
+  }
+  if (body?.code === 'no_text_sender') {
+    return { isError: true, text: `${msg} Nothing was stored, so nothing will be sent.` }
+  }
+  if (status >= 500) {
+    return { isError: true, text:
+      `${msg ?? `Agnoclast could not finish that (${status}).`} ⚠ The request MAY have been created anyway. ` +
+      `Do NOT call send_imessage again — ask the user to check Email in Agnoclast.` }
+  }
+  return { isError: true, text: msg ?? `send_imessage failed (${status}).` }
 }
 
-// Tool entry: decide, then act. Returns MCP content text.
-export async function runSendImessage({ recipient, message, send, confirm }) {
-  const decision = decideSend({
-    recipient, message, send, confirm,
-    allowlist: loadSendAllowlist(),
-    confirmSecret: process.env.CORTEX_IMESSAGE_SEND_CONFIRM ?? null,
-  })
-  if (decision.action === 'draft') {
-    return `📝 DRAFT (not sent) — to ${recipient}:\n${message}\n\n(${decision.reason})`
-  }
-  if (decision.action === 'blocked') {
-    return `🚫 Not sent: ${decision.reason}`
+/**
+ * Tool entry. `request` is the injected POST (fetchCortex with retries off, in server.mjs), so this
+ * stays testable without a network.
+ */
+export async function runSendImessage({ recipient, message, send }, request) {
+  if (!recipient || !String(recipient).trim()) return { isError: true, text: 'Name who to text: a phone number or an iMessage email address.' }
+  if (!message || !String(message).trim()) return { isError: true, text: 'The text is empty.' }
+  if (send !== true) return { isError: false, text: draftText({ recipient, message }) }
+  let res
+  try {
+    res = await request({ to: String(recipient).trim(), text: String(message) })
+  } catch (e) {
+    return { isError: true, text:
+      `Could not confirm the text request: ${e?.message ?? e} ⚠ It may have been created anyway. ` +
+      `Do NOT call send_imessage again — ask the user to check Email in Agnoclast.` }
   }
-  const r = await sendViaOsascript(recipient, message)
-  return r.ok ? `✅ Sent to ${recipient}.` : `❌ Send failed: ${r.error || 'Messages.app returned an error (is it signed in to iMessage? is Automation permission granted?)'}`
+  const body = await res.json().catch(() => null)
+  return textRequestReply(res.status, body, recipient)
 }

package/lib/server.mjs

@@ -5869,23 +5869,32 @@ function renderNudge(payload) {
     },
   )
 
-  // send_imessage — local outbound texting (NOT org intelligence; writes nothing to Agnoclast). Runs on
-  // this machine via Messages.app. Draft-by-default + recipient allowlist + OOB confirm (D3/D6/D10).
+  // send_imessage — ask to send a text from the user's own Mac (ADR-0076). It no longer texts from this
+  // machine: it creates a request on Agnoclast that waits on /email → Waiting for the user's OK (or their
+  // web send rule approves it), and the user's Mac — the desktop app, through Messages — sends it and
+  // reports back. The same contract as request_send_email: reviewUrl PRESENT = pending, relayed verbatim.
+  //
+  // ⚠ NOT IDEMPOTENT: `idempotent: false, retries: 0`, exactly as request_send_email, so a widened
+  // fetchCortex default can never make sending a text retriable.
   server.registerTool(
     'send_imessage',
     {
-      title: 'Send an iMessage (draft-by-default)',
-      description: 'Compose/send an iMessage via the local Messages app. SAFE BY DEFAULT: without send:true it only returns a draft preview. Sending requires the recipient to be on CORTEX_IMESSAGE_SEND_ALLOWLIST (or an out-of-band confirm). Use this to text someone on the user\'s behalf — always show the draft and get the user\'s OK before sending.',
+      title: 'Ask to send a text (iMessage) from the user\'s Mac',
+      description: 'Text someone from the USER\'S OWN Mac, through Messages. Without send:true this only returns a draft preview. With send:true it creates a request that WAITS for the user to approve it in Agnoclast (Email → Waiting), unless their own send rule allows it; once approved, their Mac sends it within about a minute. The text is frozen when the request is made, so write the final wording, and show the user what you are about to send first. Returns an approval link to relay, or confirmation that their rule approved it. ⚠ NEVER call it twice with send:true for the same text — it is not idempotent.',
       inputSchema: {
-        recipient: z.string().describe('phone number (e.g. +18015551234) or iMessage email'),
-        message: z.string().describe('the message body to send'),
-        send: z.boolean().optional().describe('must be true to actually send; omit/false returns a draft preview only'),
-        confirm: z.string().optional().describe('out-of-band confirm secret, required to send to a recipient not on the allowlist'),
+        recipient: z.string().describe('one phone number (e.g. +18015551234, or (801) 555-1234 for a US number) or iMessage email address'),
+        message: z.string().describe('the text to send'),
+        send: z.boolean().optional().describe('true to ask the user to approve sending it; omit or false for a draft preview only'),
+        confirm: z.string().optional().describe('NO LONGER USED — approval happens in Agnoclast now. Ignored.'),
       },
     },
-    async ({ recipient, message, send, confirm }) => {
-      const text = await runSendImessage({ recipient, message, send, confirm })
-      return { content: [{ type: 'text', text }] }
+    async ({ recipient, message, send }) => {
+      const r = await runSendImessage({ recipient, message, send }, (body) => fetchCortex(`${BASE}/api/texts/send-requests`, {
+        method: 'POST',
+        headers: { Authorization: `Bearer ${TOKEN}`, 'Content-Type': 'application/json' },
+        body: JSON.stringify(body),
+      }, { idempotent: false, retries: 0 }))
+      return r.isError ? toolError(r.text) : { content: [{ type: 'text', text: r.text }] }
     },
   )
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@theronap/agnoclast-mcp",
-  "version": "0.9.210",
+  "version": "0.9.211",
   "description": "Connect your AI assistant to Cortex — your org's projects, activity, gaps, and directives, scoped to you.",
   "type": "module",
   "bin": {